Confirmation of stealth Windows Update

Breaking news - Latest from Microsoft 

I can now confirm that the stealth Windows Update that I blogged about yesterday actually exists - because I've detected its presence on a machine at the PC Doc HQ.

At the PC Doc HQ we have several systems set not to update automatically. This is so that they are kept at a specific patch level for testing duties. Many of these systems are virtual machines but some are physical. When I heard about this stealth update I decided to take a look at one of these systems that don't update automatically (it was set to download and notify) - and within seconds I found what I was looking for.

[UPDATED - Just to clarify, I can confirm that this stealth update was applied to systems where Windows Update was set to "Download updates but let me choose whether to install them" and "for updates but let me choose whether to download and install them" but not on systems set to "Never check for updates."] 

Which files are updated depends on the OS you are running. The updated files on Vista are:

• wuapi.dll
• wuapp.exe
• wuauclt.exe
• wuaueng.dll
• wucltux.dll
• wudriver.dll
• wups.dll
• wups2.dll
• wuwebv.dll

And on XP SP2:

• cdm.dll
• wuapi.dll
• wuauclt.exe
• wuaucpl.cpl
• wuaueng.dll
• wucltui.dll
• wups.dll
• wups2.dll
• wuweb.dll

The test system was running Windows XP SP2. Reports and rumors suggest that this update was being pushed out on or around the 24th of August so I fired up Event Viewer and scrolled down to this date ... and here's what I found:

Here's the entry showing the update kicking off.

Update completed successfully - but not the lack of information regarding the update.

Here's one of the updated files.

These updates without notification is a slippery slope. I just don't like the idea of having updates foisted upon systems without being aware that they are coming in and having the option to postpone them. Why? Simple. IT'S MY PC!!! If a user chooses not to have updates installed automatically, Microsoft needs to respect this decision. Period. If this is not possible, notifications should be made after the update has been installed clearly identifying the updates, describing what it does and giving users a way to roll back the system if they want to.

[poll id=175]

Thoughts?